hxxps://gofile[.]io/d/pAXkdm

Resubmissions

05/07/2024, 06:12

240705-gychwatekm 1

05/07/2024, 06:01

240705-gqxtvatdpl 6

05/07/2024, 05:55

240705-gmv6vawdrf 1

Analysis

max time kernel
186s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/pAXkdm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
660	msedge.exe
660	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 4380	660	msedge.exe	80
PID 660 wrote to memory of 4380	660	msedge.exe	80
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 5024	660	msedge.exe	84
PID 660 wrote to memory of 2652	660	msedge.exe	85
PID 660 wrote to memory of 2652	660	msedge.exe	85
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86
PID 660 wrote to memory of 1668	660	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/pAXkdm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabfe046f8,0x7ffabfe04708,0x7ffabfe04718
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12735360574885949963,18106964179556534492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbc957a83b42f65c351e04ce810c1c11

SHA1
78dcdf88beec5a9c112c145f239aefb1203d55ad

SHA256
7bb59b74f42792a15762a77ca69f52bf5cc4506261a67f78cd673a2d398e6128

SHA512
efad54eb0bd521c30bc4a96b9d4cb474c4ca42b4c108e08983a60c880817f61bc19d97538cc09a54b2db95ab9c8996f790672e19fb3851a5d93f174acdfac0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5b6ff6669a863812dff3a9e76cb311e4

SHA1
355f7587ad1759634a95ae191b48b8dbaa2f1631

SHA256
c7fb7eea8bea4488bd4605df51aa560c0e1b11660e9228863eb4ad1be0a07906

SHA512
d153b1412fadda28c0582984e135b819ba330e01d3299bb4887062ffd6d3303da4f2c4b64a3de277773f4756da361e7bc5885c226ae2a5cfdd16ee60512e2e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
53e46ea2693965315ba2bc89cfcbb2a8

SHA1
86f4ab04d511e92d33bfad9610c93276ed4ceb19

SHA256
965ba0bb72459463c332eb98905fe3c0ee1e15f6d7aefcb91997094f1ae38e1e

SHA512
ff6d418f70288c38afd70b6091af049d498b7aaef9b4e613f6e8635e7949a5007f39c64f96b15f6347e9d5a85ea87c24057140fa898cc2b0f7bee7fec4cdfc0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
36aff20d15c296e10595666430f07c8f

SHA1
4b6ecf125b41953436deb4e9532d53a454b46a6c

SHA256
83fa9cee31a53ea617db99b6f8722a32a608ceec6414b5efe469e95ca70e06ef

SHA512
ae3751ca5dedf6916eb5af2bbcc65f9c5b9fdf43723b1a2389a7a776bf887bf45a65fe6bfc9d2ce10a56eceb4e616b547ec428e66dde79505f0985629e7d2186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12fca72cf0f875f1a6e2f5172d26a3ef

SHA1
1596c8cf992fcb8712da0aa14522a53102a7692c

SHA256
d655f61dbc2746d43cab61bb1800691bbf02d7a9bf475079ca3689d9331378da

SHA512
8efb634b47bc25c496d092e368da0c4234a3b4772c91a1637625c797b9b50bc3869a2243b32d5e5ec07e70fd534a9c498d55b3a891745b8b4ff3516ccd543b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dafba0a56de1ddb7e4f3f06a43a1948a

SHA1
f859f82d5a46ecba33c16bdd70a07104bb71ea80

SHA256
0f871f469c3ffcb5bb6eb19cbf696fa1698a61e1b1e2fa5a44dd8e7631d00721

SHA512
8d44b4a13fd7708bbcfb4de25b215caa98ae3ed5ee02700ca7bc9b5d71bf2150b864442806bc9ecc3307acedd172bc0d2967da553c24c79639e00e330c1a1fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2087e44fe36e625a1ffb0b5391d13a18

SHA1
6666240babf2d1b60b17263a1e9fcac65922d86e

SHA256
33c384e0f172e817a415be6bc9eb51cff9c8776b232ccfe0ef6f2c78237d850d

SHA512
f510ca89774e5e5e2e5407086dad2fa56d2dde94c28e8692c82819ce518bd425d1a41b5ed4775ee811dea6b8593b3d6947b96ecea3e6332aa45e1995c8369143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
827e3bc76d6cd1f752d33350c83f2ed0

SHA1
c7dad992fde4020b2a637bf4578e4de6d1da9f17

SHA256
398322f52deaf44a80fc9b2b3716a12cc929a9d4db373f284f972aa36f3beff0

SHA512
0c141a585409c8d5cd30a8058f5da7956838788a9f835250db85ff12a6e4d6ddeac3c56bfeed9a97ee09703b20f03efe239f12204e174ac32112f4e630769a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ef32605620a1458aab1de7738cc2709

SHA1
27a5203e6dbc4074defcfeb7d779df517abcd9c8

SHA256
ce085ed47cd12f4e21ecc41ba97ba927946736cbe39b2f7d9781b1a3e886dc1d

SHA512
37da76abf2cd6d081e6fd6fb8bbb540405421d902c86e78c9663a8259df71277a838650a6cb61168bf5fc52ecfd0dfeb120cffea54bd7bcdae953b208c19a305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f385fb12adb49b8dda079f85f4ec76b8

SHA1
7b26af49451575a28631e8c96e4ec2f92422315d

SHA256
7e15da2cefa2bf39ef878061d0c986ed8cb0eab00a8546952ed3b01268c4fbec

SHA512
7008a36f4047fd9164924c1fe16cea3dfb0e25900e4414d38d811c787e30c406e32e73470cb75ba86e4238bff20b88b64befda9feb0b6a5ba4f2ab9961adc567

Download Submit